Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 20:26

General

  • Target

    b31a3467a70050552aa1d5b24f19b97f3f8c95e2e0dbfe8223bd844a7c2da56e.exe

  • Size

    1.1MB

  • MD5

    8f63cd72fc0fd5bcbe8bf285d7cbb97b

  • SHA1

    8ff3a1147585ed7b23ffa817619cda109fb7cb59

  • SHA256

    b31a3467a70050552aa1d5b24f19b97f3f8c95e2e0dbfe8223bd844a7c2da56e

  • SHA512

    4025dec8792de3404f6c0a9ce76348fd124f6799f35d90129efab6ce5dd8c08e21b0ea33634807118d5a7a95978b2198d9a70d9a188faba38e5e365f9f522d76

  • SSDEEP

    24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QR:acallSllG4ZM7QzMi

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b31a3467a70050552aa1d5b24f19b97f3f8c95e2e0dbfe8223bd844a7c2da56e.exe
    "C:\Users\Admin\AppData\Local\Temp\b31a3467a70050552aa1d5b24f19b97f3f8c95e2e0dbfe8223bd844a7c2da56e.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2180

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          753B

          MD5

          048e4b2d89567321ddfdc9e8ce76f557

          SHA1

          04da8988ef555bbffe6cbfd76ee7a89a9869e672

          SHA256

          54bee13e47ead35549fe5ccae29ee1aca94a582b040174555f80fb5c5e105813

          SHA512

          d35314235a90ea63756aecc71375673bf528d256144d0ca6ca5f3e5cbccc2bdb1f1609552ab71ad44208cec13bf1e05c5dbde7d2d410daef88e181fec22b0190

        • memory/1048-0-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB

        • memory/1048-9-0x0000000000400000-0x000000000055F000-memory.dmp

          Filesize

          1.4MB